*******************************************************************************
* *
* Bugcheck Analysis *
* *
*******************************************************************************
PAGE_FAULT_IN_NONPAGED_AREA (50)
Invalid system memory was referenced. This cannot be protected by try-except,
it must be protected by a Probe. Typically the address is just plain bad or it
is pointing at freed memory.
Arguments:
Arg1: fffff8a02d483008, memory referenced.
Arg2: 0000000000000000, value 0 = read operation, 1 = write operation.
Arg3: fffff880012ed678, If non-zero, the instruction address which referenced the bad memory
address.
Arg4: 0000000000000002, (reserved)
Debugging Details:
------------------
Could not read faulting driver name
READ_ADDRESS: GetPointerFromAddress: unable to read from fffff8000310b100
GetUlongFromAddress: unable to read from fffff8000310b1c0
fffff8a02d483008 Paged pool
FAULTING_IP:
MpFilter+31678
fffff880`012ed678 0fb74604 movzx eax,word ptr [rsi+4]
MM_INTERNAL_CODE: 2
CUSTOMER_CRASH_COUNT: 1
DEFAULT_BUCKET_ID: WIN7_DRIVER_FAULT
BUGCHECK_STR: 0x50
PROCESS_NAME: MsMpEng.exe
CURRENT_IRQL: 0
ANALYSIS_VERSION: 6.3.9600.17298 (debuggers(dbg).141024-1500) amd64fre
TRAP_FRAME: fffff8800695a380 -- (.trap 0xfffff8800695a380)
NOTE: The trap frame does not contain all registers.
Some register values may be zeroed or incorrect.
rax=000000001f0b3004 rbx=0000000000000000 rcx=fffff8800695a540
rdx=fffff8800695a550 rsi=0000000000000000 rdi=0000000000000000
rip=fffff880012ed678 rsp=fffff8800695a510 rbp=fffff8800695a560
r8=fffff8800695a501 r9=fffff8000304de80 r10=0000000000000000
r11=fffffa8004473a20 r12=0000000000000000 r13=0000000000000000
r14=0000000000000000 r15=0000000000000000
iopl=0 nv up ei ng nz na pe nc
MpFilter+0x31678:
fffff880`012ed678 0fb74604 movzx eax,word ptr [rsi+4] ds:00000000`00000004=????
Resetting default scope
LAST_CONTROL_TRANSFER: from fffff80002f487db to fffff80002ece8c0
STACK_TEXT:
fffff880`0695a218 fffff800`02f487db : 00000000`00000050 fffff8a0`2d483008 00000000`00000000 fffff880`0695a380 : nt!KeBugCheckEx
fffff880`0695a220 fffff800`02ecc9ee : 00000000`00000000 fffff8a0`2d483008 fffffa80`04407f00 00000000`00000000 : nt! ?? ::FNODOBFM::`string'+0x3fdd6
fffff880`0695a380 fffff880`012ed678 : 00000000`00000000 fffff8a0`04482560 00000000`00000001 fffff880`0695a5c0 : nt!KiPageFault+0x16e
fffff880`0695a510 00000000`00000000 : fffff8a0`04482560 00000000`00000001 fffff880`0695a5c0 fffffa80`00000016 : MpFilter+0x31678
STACK_COMMAND: kb
FOLLOWUP_IP:
MpFilter+31678
fffff880`012ed678 0fb74604 movzx eax,word ptr [rsi+4]
SYMBOL_STACK_INDEX: 3
SYMBOL_NAME: MpFilter+31678
FOLLOWUP_NAME: MachineOwner
MODULE_NAME: MpFilter
IMAGE_NAME: [COLOR=red]MpFilter.sys[/COLOR]
DEBUG_FLR_IMAGE_TIMESTAMP: 54efb880
FAILURE_BUCKET_ID: [COLOR=red]X64_0x50_MpFilter+31678[/COLOR]
BUCKET_ID: X64_0x50_MpFilter+31678
ANALYSIS_SOURCE: KM
FAILURE_ID_HASH_STRING: km:x64_0x50_mpfilter+31678
FAILURE_ID_HASH: {0a75203c-fb4d-2bfc-a4dc-6cf169fe3e15}
Followup: MachineOwner
---------